From 1645a0f661ca3361599c35661d4784bf9fc56400 Mon Sep 17 00:00:00 2001
From: Luke Wilkinson <95864695+krakenhavoc@users.noreply.github.com>
Date: Mon, 22 Jun 2026 23:09:26 -0400
Subject: [PATCH] docs: weekly documentation audit 2026-06-23

---
 CHANGELOG.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d1cf13b..737e8b1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,16 @@ Notable changes to the KrakenKey cert-action. Format follows [Keep a Changelog](
 
 ## [Unreleased]
 
+### Changed
+- **Release Pipeline**: release trigger restricted to `v[0-9]+.[0-9]+.[0-9]+` tags only; major-version pointer tags (e.g. `v1`) no longer retrigger the workflow. Structured release notes auto-generated from CHANGELOG using `.github/release.yaml` label categories. Each release marked `latest` via `make_latest: true`.
+
+### PKI Advisories
+
+- **SC-098v2 — CAA RFC 8657 Parameters**: CA/B Forum ballot SC-098v2 (passed 2026-05-13) makes RFC 8657 `validationmethods` and `accounturi` CAA record parameters mandatory for all public CAs by **March 2027**. This action issues certificates via Let's Encrypt ACME DNS-01. If a user's CAA record sets `validationmethods`, it must include `dns-01`. No configuration change required today.
+- **Chrome EKU Separation — enforced 2026-06-15**: TLS intermediates must be `serverAuth`-only (no `clientAuth`). Let's Encrypt intermediates (used by this action) are already compliant. Users issuing via DigiCert or Sectigo should re-issue affected certificates.
+- **CT Mandatory Logging — enforced 2026-06-15**: Chrome Root Program Policy v1.8 §1.3.4.1 requires precertificate CT logging before issuance. DigiCert removed opt-out settings 2026-06-01. Let's Encrypt always CT-logs; no action required for users of this action.
+- **LE Merkle Tree Certificates — announced 2026-06-03**: Let's Encrypt announced that Merkle Tree Certificates (MTC) are their planned post-quantum issuance path. Staging: late 2026; production: 2027. MTC does not use the traditional `chain.pem` / `fullchain.pem` model. **This action will require updates before the production rollout.**
+
 ---
 
 ## [v1.1.0] — 2026-05-18